This is actually a cool idea - paying idiot tax
This is what GDPR should be about.
Knuddels: Chat platform must pay after hacker attack fine
71–80 of 125 posts
Re: Knuddels: Chat platform must pay after hacker attack fine
#72Earlier quoted context omitted.
http://plaintextoffenders.com/post/4629405305/discovercardco... Ugh. A credit card company...really?
IME banks often have poor security. And why not? They managed to rebrand robbery as identity fraud.
It's just infuriating, because credit card companies are the ones behind, for example, PCI. Which has guidance like:
"8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography"
Re: Knuddels: Chat platform must pay after hacker attack fine
#73Re: Knuddels: Chat platform must pay after hacker attack fine
#74Earlier quoted context omitted.
But what if people have multi-word passwords? At that point the solutions become so over-engineered(either use some ngram-like setup to detect passwords being posted or save a hash for each separate word of the user's password, which also decreases security since then you know the user has a multi-word password) that you might as well drop that feature.
Just forbid spaces?
That significantly reduces entropy in the password.
Also, the premise is faulty, because as soon as users figure out they can't type their password in the chat, they'll just describe it in words or split it into two pieces etc.
Re: Knuddels: Chat platform must pay after hacker attack fine
#75Earlier quoted context omitted.
"Passwords were hashed as a hash in 2016, but the unchanged version of the passwords has been retained, so users can not filter their own password via our platform via a filter" https://www.archynety.com/tech/why-knuddels-saved-his-passwo... Which sounds odd. You could just hash/compare filter words. I'm guessing similar issues too, like "no salt" or "same salt for all passwords".
What does filtering your own password mean on that platform?
Found the quote from a company rep on their chat forum:
https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number...
Re: Knuddels: Chat platform must pay after hacker attack fine
#76Earlier quoted context omitted.
Well, the fine is only 20k€ because they were very cooperative, quick to fix the worst issues, and promised to continue improving their security further. According to the Data Protection Officer's statement their total expenses were in the six figures. They also explicitly state that the fine wasn't higher as not to place a disproportionate burden on the company's finances, which probably means that they wouldn't hav…
Yes, I saw that elsewhere when I'd finished writing. More cooperative still would be doing the changes before you're caught. If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay. In short, in terms of pour encourage les autres this fails badly IMO.
> If you could skip your tax bill for a few years, but get a much smaller fine if you cooperated when caught then you'd be silly to actually pay.
If you do the work ahead of time, you pay the cost of doing the work. If you wait for the fine, you pay the cost of doing the work plus the fine. It doesn't take a lot of fine to make doing the work to begin with worth it -- basically just accounting for chance of getting away with it and time value of money, which goes down as the government gets better at catching more people quicker, as should be their primary goal for something like this.
Re: Knuddels: Chat platform must pay after hacker attack fine
#77Attack, succeed and blackmail could become a business. "If you don't pay me X we'll report you under GDPR and you'll have to pay much more."
"If you don’t pay me X we’ll report you under criminal law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under environmental protection law and you’ll have to pay much more." "If you don’t pay me X we’ll report you under labour regulations law and you’ll have to pay much more." How would GDPR be special?
> How would GDPR be special?
The proportion of businesses who are unintentionally violating it is unusually high.
Re: Knuddels: Chat platform must pay after hacker attack fine
#78Earlier quoted context omitted.
Fines need to be extremely punitive to make the risk-reward analysis favour fixing security _before_ the company gets caught.
Even the threat of death penalty doesn't stop crimes. True, if there is no punishment and a threat is teethless nobody acts on it (that's why the big GDPR outcry also came only this year after the two year introductory phase) However if you have too high fines what happens s that companies try everything to hide the fault and lie to avoid the fines. Here a company complied to all things, improved security (which acco…
There is a significant difference between deterring personal crimes (e.g. robbery at gunpoint, carjacking, murder) and deterring 'economic crime'.
Some examples of economic crime would be: not implementing security, tax fraud, overweight freight trucks; speeding to make a delivery on time (whilst on the clock).
The first kind of crime is generally made by people who 'know they are wrong, but they feel like they don't have other options' or people who 'know they are wrong, but don't give a f*ck about that'. Especially that first type of person won't respond to more punishment.
The second kind of crime is much more calculated. Here, the response to harsher punishment would be a lot better. This is generally why the fines on overweight trucks are so high. It is actually required in order to make the calculation unacceptable for driving overweight.
Re: Knuddels: Chat platform must pay after hacker attack fine
#79Earlier quoted context omitted.
Someone should send a friendly email to each of those offenders, linking the ruling. It's also fair to say that the next few years will be a busy time for the government agencies tasked with GDRP enforcement. (Assuming they do it properly, which falls within the responsibility of the relevant country)
They should, though assuming a bloated org structure and process, fixing it now is probably more expensive than the €20000 fine.
For a larger company, should be considerably higher.
Also, the ruling mentioned a reduced fine for cooperation and quick remediation. This probably wouldn't play out so well with a bloated structure and process, as you mentioned.
Re: Knuddels: Chat platform must pay after hacker attack fine
#80Earlier quoted context omitted.
But which proves that access to the website codebase will grant you access to those passwords.
It's a matter of storing it in plaintext or not, which any sane developer knows not to. The codebase will always have access to your plaintext password at one point or another, whether it's on signup before they hash and store it, or when you login before comparing hashes. If someone has access to your codebase you've got bigger problems than plaintext passwords anyway.
The codebase will always have access to your plaintext password at one point or another.
Not necessarily. The simple solution is client-side hashing. You could combine that with challenge-response to only reveal the password hash to the server once.